Crowdstrike App in SOAR - Permissions?

[EdgeSync]

Hey there,

I am looking to Configure the Crowdstrike OAuth API app inside my SOAR instance. To connect to Crowdstrike it will require an account on the Crowdstrike Falcon instance.

I cannot find anywhere in the Documentation which states what permissions are needed for this account.
Crowdstrike details the permissions on it's website but nothing specific for the API actions which are part of the SOAR app.

Any ideas? 😕

[WalshyB]

Hi,

This will be dependent on what you want to achieve via automation with the Crowdstrike App.

For example, if you want to update detections, then the API Client you permission should have Read and Write to Detections.

We usually select the options we believe are necessary and then if additional permissions are required, we add them.